The Voice Video Endpoint must block both inbound and outbound communications traffic between Unified Capability (UC) and Videoconferencing (VC) clients independently configured by end users and external service providers for voice and video.

From Voice Video Endpoint Security Requirements Guide

SV-81197r1_rule The Voice Video Endpoint must block both inbound and outbound communications traffic between Unified Capability (UC) and Videoconferencing (VC) clients independently configured by end users and external service providers for voice and video.

Vulnerability discussion

Various communication services such as public VoIP and Instant Messaging services route traffic over their own networks and are stored on their own servers; therefore, that traffic can be accessed at any time by the provider and potentially intercepted. Communication clients independently configured by end users and external service providers include, for example, instant messaging clients. Traffic blocking does not apply to communication clients that are configured by organizations to perform authorized functions.

Check content

If UC and VC clients cannot be independently configured by either end users or external service providers, this is Not Applicable. Verify the Voice Video Endpoint blocks both inbound and outbound communications traffic between UC and VC clients independently configured by end users and external service providers for voice and video. If the Voice Video Endpoint does not block both inbound and outbound communications traffic between UC and VC clients independently configured by end users and external service providers, this is a finding.

Fix text

Configure the Voice Video Endpoint to block both inbound and outbound communications traffic between UC and VC clients independently configured by end users and external service providers.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.